Paris Martineau is an investigative reporter at Consumer Reports, and on October 9 she published the best post-mortem anyone has written on the 2026 Cyclospora outbreak: The Cyclospora Outbreak Is Over. The Gaps It Exposed Are Not. Read it. Consumer Reports spent the hours after the recall notice calling companies to decode a list written in abbreviations, and she carried the story through FDA’s closure on October 2. The piece is built around four takeaways. I agree with all four. A tip of the pen, and a few things I would add to each.
The record first. FDA closed its investigation on October 2 at 12,883 confirmed illnesses, 570 hospitalizations and two deaths in 21 states, linked to shredded iceberg lettuce from Taylor Farms de Mexico. Two environmental samples in Mexico tested positive, one from a tank of outgoing wastewater at the processing facility and one from a drainage ditch at a grower identified in the traceback. No lettuce tested positive, and FDA says there is not enough evidence to determine how the contamination happened. CDC’s season count, last updated September 15, stands at 19,883 laboratory-confirmed cases, which leaves 7,000 confirmed cases with no food named. FDA has promised an Outbreak Investigation Report before the 2027 season. That season opens May 1.
Takeaway one: the recall notice could not be read
She reconstructs the first eighteen hours. The notice went up on a Friday afternoon, July 17, without the word recall and without a product. The corrected version listed roughly thirty products in the company’s internal shorthand, with letter codes standing in for the customers who received them and no indication of where the lettuce was sold. Consumer Reports decoded some of it by calling companies with similar-sounding brand names. Only Taco Bell, Walmart, Sysco and Jack in the Box confirmed receiving the lettuce; Subway, Cross Valley Farms, Markon and Peak Fresh Produce were not publicly tied to the recall until FDA’s enforcement report weeks later. Taylor Farms told her the codes were the ones food service customers needed to pull product, and that most of the lettuce never reached a retail shelf.
What I would add: that is a description of FDA’s recall system, not just of one company’s use of it. USDA’s Food Safety and Inspection Service has published the names of retailers that received Class I recalled meat and poultry since 2008. FDA has had guidance since 2018 saying it may do the same for food; the consumer-facing list in this recall was a list of states. I have drafted a citizen petition asking FDA to require retail consignee lists on the FSIS model and to classify every recall within ten days, and a companion petition asking FDA to name the growers, processors and distributors its traceback identifies while an outbreak is still open. Both are unfiled drafts dated October 8, and on Friday I put them in front of Bruce Taylor and the leafy greens industry with a request for comments before I file.
Takeaway two: FDA and CDC left the public guessing
She walks through the false positive. A border sample was reported positive on July 18 and retracted on July 19, and a lot of people read the retraction as clearing the lettuce. It did not, and FDA had to say so at a press conference; the company’s since-deleted social posts claiming FDA had apologized, a claim FDA denied, did not help. Brian Ronholm, Consumer Reports’ director of food policy and a former USDA deputy under secretary for food safety, describes the rest: weekly federal updates while several states posted daily, FDA and CDC updates that did not match, and an FDA distribution map that showed New York until Consumer Reports asked about it, after which New York disappeared.
What I would add: I wrote on the night of July 19 that the retraction changed nothing, because the people who got sick had eaten the evidence weeks earlier and the case against the lettuce was epidemiology and traceback, not a lab result. FDA said the same thing five days later in an update that is still on its page: the false positive did not change the basis for the investigation or the epidemiological data behind the recall. The messaging gap she describes was also a knowledge gap, and it still is. Seven thousand confirmed cases this season have no food attached to them.
Takeaway three: the rule that was not in force
She lays out the record from the emails the New York Times and Bloomberg obtained through public records requests. Michigan asked Taco Bell’s parent, Yum Brands, for supply chain records on July 1, again on July 3, and a third time on July 6, when some arrived. FDA asked on July 8 and got the relevant records on July 13. The recall came on July 17. The Food Traceability Rule would have required those records within 24 hours of the request. Its compliance date was January 20, 2026. The administration moved it to July 20, 2028 in March 2025, and in November Congress wrote into the continuing resolution that ended the shutdown, Section 780 of Division B of H.R. 5371, that FDA may not spend appropriated money administering or enforcing the rule before that date. Ronholm names FMI, the Food Industry Association, as having lobbied for the delay.
What I would add: the lobbying disclosures name more than FMI. The International Foodservice Distributors Association reported supporting the 30-month extension in its own filing, the National Restaurant Association listed H.R. 5371 by number, and Publix and the National Retail Federation reported lobbying on the 2024 bill that would have stripped lot-code duties from retailers and restaurants. The Senate Appropriations Committee went the other way and directed FDA not to delay enforcement past July 2028; the rider was a House product. Congress can repeal it before May 1. FDA’s next public meeting on lot-level traceability, the engagement Congress ordered in place of enforcement, is November 6.
Takeaway four: ten actions, none aimed at what failed
She read FDA’s October 2 list of ten planned activities and found that most were already underway under the 2021 action plan, that none were aimed at the specific failures of this outbreak, and that none touched the budget cuts, the thin investigations staff or the lost monitoring programs underneath them. Ronholm calls the list a subtle admission that FDA’s outbreak and investigation protocols need to be rewritten, and says the difference would come from leadership that identifies sources faster, holds industry accountable and tells consumers clearly what it knows.
What I would add: I went through the ten on October 7 and called them commitments, not commandments. They are surveillance, studies, training and panels, and nothing in them requires anyone to test irrigation water or produce for the parasite before harvest. Six days after FDA’s ten, Bruce Taylor announced four of his own: an indefinite suspension of central Mexico iceberg harvest and processing during the CDC-defined Cyclospora season, more water and crop testing, research into detection, and a public-private task force with FDA. I answered with an agenda for that task force: 23 things the company, the industry, FDA and Congress can do before May 1, 2027. The task force has 200 days from today.
What Consumer Reports did next
The article was not the end of it. On October 8 Consumer Reports wrote to Donald Prater, FDA’s acting deputy commissioner for food, with eight questions and a November 6 deadline: what delayed the deployment to Mexico, why no import alert has issued on iceberg lettuce from central Mexico, what accounts for the month it took to classify the recall as Class I, how information moved between the federal agencies and the states, whether the department’s consolidation of communications functions hurt FDA’s ability to talk to the public, and how many people in the Human Foods Program actually work outbreaks. Those are the right questions. Fifteen letters from members of Congress have produced no published answer and no hearing. Maybe a consumer organization will do better.
Hedberg has the honest line in her piece: a fair amount of work still has to come together before anyone can say what happened this year or how to approach next year. The report FDA has promised is where that work belongs, and it has to be out before the lettuce goes in the ground. I said on October 3 that Congress, Secretary Kennedy and the produce industry could put me out of the lettuce business. Paris Martineau just wrote them the checklist. Read her piece, then read the eight questions, and watch November 6.
Recent Comments